You deploy a website, install a Let's Encrypt certificate through Plesk, and everything works perfectly — until one day the browser shows a red padlock and users start complaining about "connection not private" warnings. What happened? Plesk's automatic Let's Encrypt renewal silently failed. This is one of the most disruptive issues for hosting providers because the renewal process runs in the background and only shows its failure after the certificate has already expired. This guide walks you through every common cause and fix.
Why Does Plesk Let's Encrypt Renewal Fail?
Let's Encrypt certificates are valid for 90 days and Plesk tries to auto-renew them 30 days before expiry. Renewal fails when the ACME challenge — the process Let's Encrypt uses to verify domain ownership — cannot complete. The main causes are:
- DNS pointing to a different server: The domain's DNS records have changed (e.g., after a migration) and no longer point to your Plesk server's IP
- Port 80 blocked: HTTP-01 ACME challenge requires port 80 to be accessible from the internet
- Incorrect TXT record (DNS-01 challenge): When using external DNS, the _acme-challenge TXT record is stale or missing
- ModSecurity blocking the ACME challenge: WAF rules intercept the .well-known/acme-challenge/ request
- Certificate used by Plesk panel itself: Attempting to delete a cert that secures the Plesk UI causes an error
- Rate limiting: Let's Encrypt caps renewals at 5 per domain per week — hitting the limit during testing locks you out temporarily
💡 None of these worked? Skip the guesswork.
Get Expert Help →Step 1: Read the Renewal Error Log
The first thing to do is read the actual error message — Plesk logs all Let's Encrypt activity in detail.
tail -n 200 /var/log/plesk/panel.log | grep -i "letsencrypt\|acme\|certifi"On Windows Plesk, the log is at %plesk_dir%dmin\logs\panel.log.
tail -n 100 /var/log/plesk/letsencrypt.logCommon error messages you'll see:
Could not issue a Let's Encrypt SSL/TLS certificate for example.com— domain validation failedIncorrect TXT record found at _acme-challenge.example.com— DNS-01 challenge failureTimeout during connect— port 80 blocked or server unreachabletoo many certificates already issued— rate limit hit
dig +short example.com Acurl -s ifconfig.meIf these differ, the certificate cannot be renewed until DNS is updated. If the domain uses Cloudflare or another proxy, make sure the IP resolves to your origin, not the CDN edge — or switch to DNS-01 challenge validation (see Step 5).
curl -v http://example.com/.well-known/acme-challenge/testYou should get a 404 (file not found) — which is fine, it means port 80 is open. A connection refused or timeout means port 80 is blocked.
7. Check iptables directly:
iptables -L INPUT -n | grep "dpt:80"If there is no ACCEPT rule for port 80, add it or modify your firewall configuration through Plesk.
<Location "/.well-known/acme-challenge/">
SecRuleEngine Off
</Location>9. Alternatively, temporarily disable ModSecurity for the domain during renewal: Go to Domains > example.com > Apache & nginx Settings and disable WAF, trigger renewal, then re-enable.
Step 5: Fix Incorrect DNS TXT Record (DNS-01 Challenge)
If you're using an external DNS provider (not Plesk's built-in DNS), Plesk cannot automatically manage the _acme-challenge TXT record required for DNS-01 validation.
10. Check the current TXT record at your DNS provider:
dig TXT _acme-challenge.example.comIf the record is absent or has an old value, Let's Encrypt will fail DNS validation.
Step 6: Fix "Certificate Used by Plesk" Error
A specific error occurs when renewing a domain certificate that also secures the Plesk panel or mail server:
"Failed to renew Let's Encrypt certificate: One of the certificates you are going to delete is used for securing Plesk"
12. Issue a separate certificate for the Plesk panel. Go to Tools & Settings > SSL/TLS Certificates. Click the pencil icon next to the certificate used for the Plesk panel and select a different certificate (or issue a new one for the server's hostname only).
13. Then renew the domain certificate normally. Once the panel certificate is separated, the domain's renewal will complete without the conflict.
Step 7: Manually Trigger a Renewal
After addressing the root cause, manually trigger renewal rather than waiting for the next auto-renewal cycle.
14. Via Plesk GUI: Go to Domains > example.com > SSL/TLS Certificates. Click on the Let's Encrypt certificate entry and click Re-issue.
15. Via Plesk CLI:
plesk ext letsencrypt --renew -domain example.comWatch the output for any error messages. If renewal succeeds, you'll see a confirmation that the certificate has been updated.
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -datesThe notAfter field should show a date 90 days from today if renewal succeeded.
Preventing Future Renewal Failures
To avoid unexpected certificate expiry:
- Ensure DNS records are stable and point to your Plesk server before provisioning Let's Encrypt
- Keep port 80 open permanently — many admins close it thinking HTTPS is sufficient, but ACME needs it
- Use Plesk's built-in DNS zone when possible, as it manages TXT records automatically
- Set up email alerts in Plesk for certificate expiry under Tools & Settings > Notifications
- Consider a managed server management service to monitor certificate renewals across all domains automatically
Conclusion
Plesk Let's Encrypt renewal failures almost always trace back to one of six root causes: DNS mismatch, port 80 blocked, ModSecurity interference, external DNS TXT record issues, certificate conflicts with the Plesk panel, or rate limiting. By reading the panel log first and working through each cause systematically, you can restore HTTPS within minutes and configure the server to prevent the same failure from recurring.
